SP-IIQ Practice Test

SP-IIQ practice test: what's covered

• IIQ architecture
• provisioning
• certifications
• role engineering
• LCM

Free SP-IIQ sample questions

1. An organization needs a consolidated view of a user, including all their accounts across connected applications and their attributes. In SailPoint IdentityIQ, this is called:

   • A. A Business Role configured in the system
   • B. An Identity Cube — the canonical aggregated identity record IIQ maintains in its database, the source of truth for all governance decisions
   • C. A central repository for user attributes
   • D. A Certification Campaign item
   Show answer

   Correct: B and C. Identity Cube = aggregated identity. Built by correlation rules linking accounts from authoritative source (HR) to target accounts. Holds attributes, entitlements, account links, history. All policy/cert/workflow decisions read from the Cube.

2. Which IIQ task reads accounts and entitlements from a connected target system and updates the Identity Warehouse?

   • A. Provisioning task configured for the application
   • B. Aggregation task — reads from target application via connector and stores in IIQ DB; can be account-only, group-only, or both
   • C. A process that pulls accounts from targets
   • D. Certification task for manager review
   Show answer

   Correct: B and C. Aggregation = pull. Provisioning = push. Refresh = post-aggregation rule re-evaluation (role assignment, policy scan, manager correlation). Schedule: full aggregation off-hours, delta aggregations frequently.

3. After aggregation completes, what task should typically run next to evaluate role assignments, policy violations, and refresh identity attributes?

   • A. Provisioning plan execution
   • B. Identity Refresh task — re-evaluates role assignment rules, runs SoD policy scans, recalculates risk scores, fires lifecycle events
   • C. Task that recalculates risk scores
   • D. System reset and cache clearing
   Show answer

   Correct: B and C. Refresh is THE engine that turns raw aggregated data into governance state. Options include: refresh assigned roles, refresh entitlement correlation, refresh manager status, check policies, trigger events. Skip refresh = stale identity state.

4. An IIQ deployment behind a corporate firewall needs to read from a cloud HR system (Workday). What architectural pattern is used?

   • A. Open the internal firewall directly to the public internet
   • B. IIQ calls Workday SOAP/REST API outbound through corporate proxy; no inbound exposure of IIQ needed for this direction
   • C. IIQ uses standard web API requests to read from Workday
   • D. Use flat file transfers via SFTP exclusively
   Show answer

   Correct: B and C. IIQ-initiated outbound = standard pattern. Workday provides Reports-as-a-Service (RaaS) or Workday REST. Configure connector with credentials + proxy, schedule aggregation.

5. In IIQ database design, what is the purpose of the spt_link table?

   • A. Storing business and IT role definitions
   • B. Stores account-to-identity correlation — each row links one target-system account (Account) to one Identity Cube; the join that powers 'show me all accounts for this user'
   • C. It acts as a correlation bridge between apps and identities
   • D. Storing background task execution history
   Show answer

   Correct: B and C. spt_link = the correlation table. spt_identity = identities. spt_application = connected apps. spt_link bridges identity ↔ accounts on apps. Many SailPoint admins debug correlation issues by querying this table directly.

Last updated: 2026-10-19

SP-IIQ practice test FAQ